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CLAIMS 

What is claimed is: 

1 . A method for tracking entities in a computer network, comprising: 

5 a) receiving node information for a node coupled to a computer network; 

b) determining whether an entity associated with said node has been 
previously identified in said computer network; 

c) linking said node information to an existing database entry for said entity 
if said entity has been previously identified in said computer network; and 

1 0 d) creating a new database entry for said entity if said node has not been 

previously identified in said computer network and linking said node information to 
said new database entry for said entity. 

2. The method of Claim 1 , wherein said b) comprises: 

15 b1) determining if a unique identifier from said node information matches a 

unique identifier for said entity in said database. 

3. The method of Claim 2, wherein said unique identifier comprises a security 
identifier. 

20 

4. The method of Claim 2, wherein said unique identifier comprises a serial 
number. 

5. The method of Claim 1 , wherein said b) further comprises determining if a 
25 media access control (MAC) address from said node information matches a MAC 
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address in said database, if there is not a unique identifier for said entity in said 
node information. 

6. Tlie method of Claim 5, wherein said b) further comprises determining if a 
5 IP (Internet Protocol) address from said node information matches a computer 

name associated with said IVIAC address in said database. 

7. The method of Claim 6, wherein said b) further comprises determining if a 
domain name from said node information matches a domain name associated 

1 0 with said MAC address and said computer name in said database. 

8. The method of Claim 6, wherein said b) further comprises determining if an 
operating system from said node information matches an operating system 
associated with said MAC address and said computer name in said database. 

15 

9. The method of Claim 1, wherein said b) further comprises: 

b1) determining if a computer name from said node information matches a 
computer name in said database; and 

b2) determining if a domain name from said node information matches a 
20 domain name associated with said computer name in said database. 

10. The method of Claim 1 , wherein said entity is computer system running a 
particular operating system. 
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1 1 . The method of Claim 1 , wherein said entity is a user of said computer 
network. 

12. The method of Claim 1 , wherein said entity is a computer system. 

5 

13. A computer readable medium having stored thereon instructions which, 
when executed on a general purpose processor, implement a method for tracking 
entities in a computer network, said method comprising: 

a) receiving node information related to a node in a computer network; 
10 b) uniquely identifying an entity associated with said node information; 

c) linking said node information to said entity if an entry exists in a database 
for said uniquely identified entity; and 

d) creating a new entry in said database for said entity if no entry exists for 
said uniquely identified entity and linking said node information to said new entry. 

15 

14. The computer readable medium of Claim 13, wherein said method further 
comprises: 

b1) determining if a unique identifier from said information for said node 
matches a unique identifier in said database. 

20 

15. The computer readable medium of Claim 14, wherein said unique identifier 
comprises a security identifier. 

16. The computer readable medium of Claim 14, wherein said unique identifier 
25 comprises a serial number. 
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17. The computer readable medium of Claim 13, wherein said b) of said 
method further comprises determining if a media access control (MAC) address 
from said node information matches a MAC address in said database, if there is 

5 not a unique identifier of said entity in said node information. 

18. The computer readable medium of Claim 17, wherein said b) of said 
method further comprises determining if a computer name from said node 
information matches a computer name associated with said MAC address in said 

10 database. 



19. The computer readable medium of Claim 18, wherein said b) of said 
method further comprises determining if a domain name from said node 
information matches a domain name associated with said MAC address and said 
15 computer name in said database. 



20. The computer readable medium of Claim 19, wherein said b) of said 
method further comprises determining if an operating system from said node 
information matches an operating system associated with said MAC address, said 
20 computer name, and said domain name in said database. 



21 . The computer readable medium of Claim 13, wherein said b) of said 
method further comprises: 

b1) determining if a computer name from said node information matches a 
25 computer name in said database; and 
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b2) determining if a domain name from said node information matclies a 
domain name associated with said computer name in said database. 

22. The computer readable medium of Claim 13, wherein said entity is a 
5 computer system running a particular operating system. 

23. The computer readable medium of Claim 13, wherein said entity is a user. 

24. The computer readable medium of Claim 13, wherein said entity is a 
1 0 computer system. 

25. A method for tracking entities in a computer network comprising: 

a) receiving node information related to a node on said computer network; 

b) determining if a database entry exists for an entity associated with said 
15 node by searching said database for a unique identifier from said node 

information that is able to uniquely identify said entity, if said unique identifier 
exits; 

c) determining if said database entry exists by searching said database 
using multiple identifiers from said node information that are not able to 

20 individually uniquely identify said entity, if said node information does not include 
said unique identifier; 

d) linking said node information to said entry if said entry exists; and 

e) creating a new entry in said database for said entity if no entry exists for 
said entity, and linking said node information to said new entry. 

25 
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26. The method of Claim 25, wherein said multiple identifiers comprise a media 
access control (MAC) address. 

27. The method of Claim 26, wherein said multiple identifiers further comprise a 
5 computer name. 

28. The method of Claim 27, wherein said multiple identifiers further comprise a 
domain name. 

10 29. The method of Claim 28, wherein said multiple identifiers further comprise 
an operating system. 

30. The method of Claim 28, wherein said multiple identifiers comprise at least 
two of: a media access control (MAC) address, a computer name, a domain name, 

15 and an operating system. 

31 . The method of Claim 25, wherein said unique identifier comprises a 
security identifier. 

20 32. The method of Claim 25, wherein said unique identifier comprises a serial 
number. 

33. The method of Claim 25, further comprising: 

f) returning an identifier for an entity in response to a request including a 
25 node identifier. 
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34. The method of Claim 25, further comprising: 

f) returning identifiers for all nodes associated with an entity in response to 
a request including an entity Identifier. 

5 

35. The method of Claim 25, further comprising: 

f) returning node information in response to a request for said node 
information including a node identifier. 

10 36. A system for tracking entities in a computer network, comprising: 

means for receiving node information related to a node coupled to a 
computer network; 

means for determining whether an entity associated with said node has 
been previously identified in said computer network; 
1 5 means for linking said node information to an existing database entry for 

said entity if said entity has been previously identified in said computer network; 
and 

means for creating a new database entry for said entity if said node has not 
been previously identified in said computer network and linking said node 
20 information to said new database entry for said entity. 

37. The system for tracking entities in a computer network of Claim 36, further 
comprising means for determining if a unique identifier from said node information 
matches a unique identifier in said database. 

25 
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38. The system for tracking entities in a computer network of Claim 36, furtlier 
comprising means for determining if a media access control (MAC) address from 
said node information matches a MAC address in said database, if there is not a 
unique identifier in said node information. 

5 

39. The system for tracking entities in a computer network of Claim 36, further 
comprising means for determining if a computer name from said node information 
matches a computer name associated with said MAC address in said database. 

1 0 40. The system for tracking entities in a computer network of Claim 36, further 
comprising: 

means for determining if a computer name from said node information 
matches a computer name in said database; and 

means for determining if a domain name from said node information 
1 5 matches a domain name associated with said computer name in said database. 

41 . A system for tracking entities in a computer network, comprising: 

a database storing therein entries related to entities in said computer 
network; 

20 an engine coupled to said database, wherein said engine is operable to: 

receive node information related to a node coupled to said computer 
network; 

determine whether an entity associated with said node has been 
previously identified in said computer network; 
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link said node information to an existing entry for said entity in said 
database if said entity has been previously identified in said computer 
network; and 

create a new entry for said entity in said database if said node has 
5 not been previously identified in said computer network and link said node 

information to said new database entry for said entity. 

42. The system for tracking entities in a computer network of Claim 41 , wherein 
said engine is further operable to determine if a unique identifier from said node 

1 0 information matches a unique identifier in said database. 

43. The system for tracking entities in a computer network of Claim 41 , wherein 
said engine is further operable to determine if a media access control (MAC) 
address from said node information matches a MAC address in said database, if 

15 there is not a unique identifier in said node information. 

44. The system for tracking entities in a computer network of Claim 41 , wherein 
said engine is further operable to determine if a computer name from said node 
information matches a computer name associated with said MAC address in said 

20 database. 

45. The system for tracking entities in a computer network of Claim 41 , wherein 
said engine is further operable to determine if a computer name from said node 
information matches a computer name in said database and determine if a 

25 domain name from said node information matches a domain name associated 
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with said computer name in said database. 
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